RE: [fw-wiz] (no subject)

From: Noonan, Wesley (Wesley_Noonan@bmc.com)
Date: 11/22/02 

From: "Noonan, Wesley" <Wesley_Noonan@bmc.com>
To: "'Dean Pullen'" <deanpullen@yahoo.com>, firewall-wizards@honor.icsalabs.com
Date: Fri Nov 22 15:56:00 2002

I am not sure why you require it in your DMZ. If you need something to act
as a bastion or proxy for SMTP email, why not use a cheapware SMTP server on
something like Linux? Even if you do need Exchange, you shouldn't need
domain rights to just do SMTP.

If you need it to provide external access to email, I would look at
something like OWA instead.

As for what to open, here is a sample from a PIX that I did a while ago
(sorry it is in conduit format)

conduit permit udp host 172.16.1.1 eq netbios-ns host 10.100.0.10
conduit permit udp host 172.16.1.1 eq netbios-dgm host 10.100.0.10
conduit permit tcp host 172.16.1.1 eq 139 host 10.100.0.10
conduit permit udp host 172.16.1.1 eq 139 host 10.100.0.10
conduit permit tcp host 172.16.1.1 eq 135 host 10.100.0.10

It provided access from the DMZ host to the DC. I think that 135 and 139 may
not have needed to be opened (I don't recall for sure and I don't have a
latest config to see if I removed them or not). Thanks.

Wes Noonan, MCSE/CCNA/CCDA/NNCSS
Senior QA Rep.
BMC Software, Inc.
(713) 918-2412
wnoonan@bmc.com
http://www.bmc.com

> -----Original Message-----
> From: Dean Pullen [mailto:deanpullen@yahoo.com]
> Sent: Friday, November 22, 2002 12:04
> To: firewall-wizards@honor.icsalabs.com
> Subject: [fw-wiz] (no subject)
>
> Hi guys,
>
> I've basically been told that we require an Exchange
> system operated within our DMZ setup. After much
> reading I've decided to go for a front-end, back-end
> Exhange system, with the Exchange front-end in the DMZ
> and the back-end in the LAN. However, even though I've
> opened up all the ports specified in MS' white papers
> between the DMZ and LAN, I cannot connect to the
> domain/active directory from the Front-End server. How
> do I go about this? I mean all I am trying at the
> moment is to connect to our internal Domain by
> accessing the network ID in the My Computer properties
> and trying typing in the Domain. Do I have to do
> anything else?! Sorry for my amateurishness(!) but
> we're a small firm and cannot afford a fully-fledged
> exchange specialist, thus I'm doing it!
>
> Thanks in advance.
>
> Dean Pullen.
>
> __________________________________________________
> Do you Yahoo!?
> Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
> http://mailplus.yahoo.com
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards@honor.icsalabs.com
> http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

Relevant Pages

  • Re: Cisco PIX config statement
    ... | SMTP_servers object group SMTP" ... nameif ethernet2 DMZ security10 ... network-object host 129.17.10.51 ... access-group inside in interface inside ...
    (comp.dcom.sys.cisco)
  • RE: Re: Re: VM Host with guests on the Internal and DMZ networks
    ... So are you saying that you should put your HOST in the DMZ. ... NIC and then add and IP Address that would work on the inside network while ... I would question the sysadmins level of competency. ...
    (Security-Basics)
  • Re: DMZ Arguments....
    ... A DMZ is used with a firewall, ... link to the rest of the network. ... A common approach for an attacker is to break into a host that's vulnerable ... the case of a web server, unauthenticated and untrusted users might be ...
    (Security-Basics)
  • [NEWS] SMC Barricades Dodgy "DMZ" Feature
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... hosts in a DMZ should not be ... able to initiate connections to internal LAN hosts. ... DMZ host be compromised (from having its connected-to-from-the-internet ...
    (Securiteam)
  • Re: DNS inside the DMZ on an 877
    ... the dmz to refer to external DNS servers for hosts outside the DMZ ... any host outside the DMZ. ... permit tcp host 192.168.168.2 host 10.0.0.10 eq 636 ... match access-group name adam ...
    (comp.dcom.sys.cisco)